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RECEIVED 

Application Number 10/057,576 CENTRAL FAX CFNTFR 

Response to Office Action mailed May 1 7, 2006 

AUG 1 7 2006 

REMARKS 

This amendment is responsive to the Office Action dated May 17, 2006. Applicant has 
amended claims 1-5, 7, 8, 1 1, 12, 14, 17, 19, 20, 22, 24, 25, 32, 34, 36, 37 and 38. Applicant has 
canceled claims 6, 15, 16 and 23. Claims 1-5, 7-14, 17-22 and 24-38 are pending upon entry of 
this amendment 



Claim Objection 

In the Office Action, the Examiner objected to claim 32 due to claim informalities. 
Applicant has amended claim 32 to recite "computer-readable medium" and "display a selected 
representative packet" as suggested by the Examiner, Applicant requests withdrawal of the 
objection. 

Claim Rejection Under 35 U,S.C, S 112 

In the Office Action, the Examiner rejected claims 5-21 and 25 under 35 U.S.C. 1 12, 
second paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention, Specifitfally^tKe Examiner rejected 
claims 5 and 14 for reciting the limitation "the captured network data" with insufficient 
antecedent basis. Applicant has amended claims 5 and 14 to recite "the captured network 
packets". Applicant has also amended claims 2, 4 and 20 to correct antecedent basis, and has 
amended claims 3, 7, 8, U, 17, 24 and 25 to correct dependency. 

In addition, the Examiner rejected claim 25 as being unclear. Applicant has amended 
claims 19 and 25 to recite "a remainder of the duplicate packets not selected to be the 
representative packet" in order to clarify that the remainder of the duplicate packets includes the 
duplicate packets not selected as the representative packet. Applicant submits that claims 5-21 
and 25, as amended, particularly point out and distinctly claim the subject matter, as required by 
35 U.S.C. 1 12, second paragraph. Applicant requests immediate withdrawal of all rejections 
under 35 U.S.C. 112. 
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Allowable Subject Matter 

In the Office Action, the Examiner indicated that claims 6-8, 1 1-13, 16-20, 25, 28-30 and 
36 are objected to as being dependent upon a rejected base claim, but would be allowable if 
rewritten in independent form including all of the limitations of the base claim and any 
intervening claims. In this amendment, Applicant has amended independent claim 5 to include 
all the subject matter recited by dependent claim 6, now canceled, which the Examiner indicated 
would be allowable if rewritten in independent form. Applicant has also amended independent 
claim 14 to include all the subject matter recited by dependent claim 16 and intervening claim 15, 
now canceled, which the Examiner indicated would be allowable if rewritten in independent 
form. Consequently, claims 5, 14 and the claims dependent therefrom are in condition for 
allowance. 

Claim Rejection Under 35 U.S.C. 8 102 

In the Office Action, the Examiner rejected claims 1 and 4 under 35 U.S.C. 102(e) as 
being anticipated by U.S. Patent No. 6,836,466 to Kant et al. ("Kant"). Applicant respectfully 
traverses the rejection to the extent such rejections may be considered applicable to the claims as 
amended. Kant fails to disclose each and every feature of the claimed invention, as required by 
35 U.S.C 102(e), and provides no teaching that would have suggested the desirability of 
modification to include such features. 

With respect to claim 1, the Examiner asserted that Kant discloses capturing network 
packets with source and destination devices that include duplicate packet counters and creating 
package data structures for duplicate packets. Kant describes monitoring a packet flow between 
any two points in a network that supports a VPN using source-destination device pairings (Col. 4, 
11. 40-42). A source device receives packets entering a monitored network, forms packages of the 
packets, and sends the packages to a destination device via an overhead channel. Kant further 
describes the destination device receiving packets leaving the monitored network, correlating the 
received packages from the source device with the packets, and calculating network performance 
based on the correlated packages (Col. 7, 11. 20-49), The packages created by the source device 
may include a duplicate count for each packet that reflects a number of duplicate packets entering 
the monitored network. The destination device determines a number of packets duplicated 



-10- 



PAGE 12/22 1 RCVDAT 8117/2008 4:20:35 PM [Eastern Daylight Time] * SVR:USPT0-EFXRF-2/1 1 1 DNIS:2738300 1 CSID:6517351102 1 DURATION (mm-ss):07-O6 



08/17/2006 14:13 6517351102 



SHUMAKER & SIEFFERT 



PAGE 13/22 



Application Number 10/057,576 

Response to Office Action mailed May 1 7, 2006 

within the monitored network by subtracting the duplicate packet counts included in the packages 
from the total number of duplicate packets at the destination device (Col. 13, 11. 1-30). 

Kant fails to describe capturing network packets from a network with a plurality of 
distributed agents positioned at different locations within the network and communicating the 
network packets to an analyzer coupled to the network, as recited by Applicant's amended claim 
1 . Instead, Kant discloses capturing network packets and calculating network performance for a 
network with source-destination pairings. In the Kant reference, the source device is coupled to 
the destination device via an overhead channel used to pass the packages created by the source 
device. The destination device in Kant analyzes the packet flow only between the source- 
destination pair based on the packets captured by the source device and the destination device. 
Kant does not describe the destination device analyzing packet flows based on packets captured 
from a plurality of distributed devices positioned at different locations within the network. 
Although the destination device may be paired with multiple source devices, an analysis is 
performed for each source-destination pair separately. 

Furthermore, Kant does not describe communicating network packets captured by a 
plurality of distributed agents positioned at different locations within the network to a centrally 
located analyzer or any other centrally located device coupled to the network, as required by 
Applicant's amended claim 1 . On the contrary, Kant states "metrics are calculated by the 
destination device 223 in real-time, as opposed to being produced by a central facility (such as 
DA [Data Analyzer] 1 16 in FIG. 1) that must process captured packet information off-line," (Col. 
6, 11. 50-57). Kant clearly teaches away from Applicant's claimed invention by specifically not 
using a centrally located analyzer to analyze packet flows within a network. 

In addition, Kant does not teach identifying duplicate network packets that were captured 
by the plurality of agents at the different locations with the analyzer , as recited by Applicant's 
amended claim 1 . The destination device in Kant correlates the packages from the source device 
with packets from the network to determine a number of packets duplicated within the network. 
As stated above, Kant discloses the destination device analyzing packet flows for a source- 
destination pair based only on packets captured by the source device and the destination device. 
Kant does not describe an analyzer that identifies duplicate packets received from a plurality of 
distributed agents at different locations within the network. 
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Kant also fails to teach displaying the duplicate network packets or non-dupiicate 
network packets based on the identifi cation of the duplicate packets, as recited by Applicant's 
amended claim 1 . Kant describes including packet header information and a duplicate packet 
count in the data structure of a package created by the source device (FIG. 10 of Kant) and in the 
header storage data structure in the destination device (FIG. 12 of Kant). However, Kant makes 
no mention of displaying or presenting the captured network packets to a user. Moreover, Kant 
never mentions including the actual duplicate packet information in the package data structure or 
the storage data structure, but merely a count of the number of duplicate packets. Kant certainly 
does not disclose displaying or presenting one of duplicate network packets and non-duplicate 
network packets to a user based on the identified duplicate packets. 

With respect to claim 4, the Examiner asserted that Kant discloses filtering packets and 
displaying duplicate packets. Kant teaches that source-destination pairings are scalable in the 
number of different packet flows that can be monitored, and that the source and destination 
devices are capable of filtering packets based on VPN or other criteria in order to monitor the 
correct packet flows (Col 7, 11. 8-1 1). However, Kant fails to describe performing filtering after 
capturing the packets and calculating network performance. Unlike Applicant's claim 4, Kant 
does not disclose filtering non-duplicate packets captured by the plurality of distributed agents at 
different locations within the network and then displaying the duplicate packets. Again, Kant 
makes no mention of displaying or presenting the captured network packets, duplicate or non- 
duplicate, to a user. 

In order to support an anticipation rejection under 35 U.S.C. 102(b), it is well established 
that a prior art reference must disclose each and every element of a claim. This well known rule 
of law is commonly referred to as the "all-elements rule." 1 If a prior art reference fails to 
disclose any element of a claim, then rejection under 35 U.S.C. 102(b) is improper. 2 



1 See Hybritech Inc. v. Monoclonal Antibodies, Inc., 802 F-2d 1 367, 23 1 USPQ 8 1 (CAFC 1 986) ("«t is axiomatic 
that for prior art to anticipate under 102 it has to meet every element of the claimed invention"). 

2 Id. See also Lewmar Marine, Inc. v. Bariera, Inc. 827 F.2d 744, 3 USPQ2d 1766 (CAFC 1987); In re Bond, 910 
V2& 831, 15 USPQ2d 1 566 (CAFC 1990); C.R Bard. Inc. v. MP Systems, Ina y 157 F-3d 1 340, 48 USPQ2d 1225 
(CAFC 1998); Oney v. Ratliff, 182 F.3d 893, 51 USPQ2d 1697 (CAFC 1999); Apple Computer, Inc. v. Articulate 
Systems, Inc., 234 F.3d 14, 57 USPQ2d 1057 (CAFC 2000). 
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Kant fails to disclose each and every limitation set forth in claims 1 and 4. For at least 
these reasons, the Examiner has failed to establish a prima facie case for anticipation of 
Applicant's claims 1 and 4 under 35 U.S.C. 102(b). Withdrawal of this rejection is requested. 

Claim Rejection Under 35 U.S.C S 103 

In the Office Action, the Examiner rejected claims 2, 3, 32-35, 37 and 38 under 35 U.S.C. 
103(a) as being unpatentable over Kant in view of McCreery (US 5,787,253)* In addition, the 
Examiner rejected claims 5, 9, 10, 14 s 15, 21-24, 26, 27 and 31 under 35 U.S.C. 1 03(a) as being 
unpatentable over U.S. Patent No. 6,085,243 to Fletcher et al. ("Fletcher") in view of McCreery. 
Applicant respectfully traverses the rejection to the extent such rejections may be considered 
applicable to the claims as amended. The applied references fail to disclose or suggest the 
inventions defined by Applicant's claims, and provide no teaching that would have suggested the 
desirability of modification*to^arriye at the claimed invention. 

Kant and McCreery 

WitrTrcspifcrto^ acknowledged that Kant fails to disclose 

displaying non-duplicate network packets and displaying a representative packet for the duplicate 
packets by comparing timestamps of the duplicate packets, as recited by Applicant's claims 2 and 
3. However, the Examiner asserted that McCreery discloses displaying captured packets with 
timestamps where non-duplicate packets are identified by different source and destination 
addresses and duplicate packets are identified by same source and destination addresses. The 
Examiner then acknowledged that Kant and McCreery fail to disclose displaying a representative 
packet for the duplicate packets, but stated that it would have been obvious to one of ordinary 
skill in the art to delete entries for duplicate packets to display one entry for the duplicate packets 
so that network performance parameters such as packet throughput would be measured without 
taking into account retransmitted packets* 

As described above, Kant does not disclose identifying duplicate network packets that 
were captured from a network by a plurality of agents positioned at different locations within the 
network with an analyzer, and displaying one of the non-dupUcate network packets and the 
duplicate network packets based on the identification, as required by Applicant's amended claim 
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I . McCreery illustrates data tables for storing packet information derived from data in packet 
data buffers (FIGS 5a-5c & 6a~6c)> McCreeiy describes a method of recompiling packet data 
within the illustrated data tables by segregating the packet data into transactions between nodes, 
sorting the packet data by the nodes, sequencing the packet data in each transaction, and deieing 
any duplicate packets from the sequence (Col. 14, 11. 47-58). McCreery also discloses a data 
management module providing real time, inferred and customized data to a user (CoL 11, 11. 63- 
67). 

However, unlike Applicant's claim 3, McCreery does not disclose comparing timestamps 
of duplicate packets and displaying one of the packets based on the comparison. Instead, 
McCreery teaches sequencing the packets 'Sda an analysis of the administrative data included in 
the packet headers such as the sequencing and acknowledgment information provided in the TCP 
segment 515, 578," (Col. 10, 11. 1 1-17). As shown in FIG. 5c of McCreery, the sequencing and 
acknowledgement information in TCP segment 578 of a packet does not include the timestamp, 
which is included in field 572 of the packet, McCreeiy then describes discarding any duplicate 
packets found after sequencing the packets based on the information in the TCP segment. 

Furthermore, contrary to the Examiner's assertion, deleting entries for duplicate packets 
does not render obvious displaying a representative packet for the duplicate packets* Applicant's 
specification describes selecting a representative packet for the duplicate packets in order to 
display one of the duplicate packets while not discarding the remainder of the duplicate packets 
not selected as the representative packets. In this way, the remainder of the duplicate packets 
may be utilized or displayed at a later time. Displaying a representative packet for the duplicate 
packets is not the same as deleting entries of duplicate packets, and would not be obvious to a 
person of ordinary skill in the art 

For at least the reasons stated above, Kant fails to disclose or suggest the requirements of 
claim 1 on which claims 2 and 3 depend. McCreery lacks any teaching sufficient to overcome 
the basic deficiencies described above with respect to Kant. Therefore, claims 2 and 3 are in 
condition for allowance. 

With respect to claims 32 and 33, the Examiner asserted that Kant discloses capturing 
network packets with source and destination devices that include duplicate packet counters and 
creating package data structures for duplicate packets. The Examiner acknowledged that Kant 
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fails to disclose displaying non-duplicate network packets and displaying a representative packet 
for the duplicate packets by comparing timestamps of the duplicate packets. However, the 
Examiner asserted that McCreery discloses displaying captured packets with timestamps where 
non-duplicate packets are identified by different source and destination addresses and duplicate 
packets are identified by same source and destination addresses. The Examiner then 
acknowledged that Kant and McCreery fail to disclose displaying a representative packet for the 
duplicate packets, but stated that it would have been obvious to one of ordinary skill in the art to 
delete entries for duplicate packets to display one entry for the duplicate packets so that network 
performance parameters such as packet throughput would be measured without taking into 
account retransmitted packets. 

For the reasons described above in reference to claim 1 , Kant does not disclose directing 
a plurality of distributed agents positioned at different locations within a network to capture 
packets from the network, receiving the captured packets with an analyzer, and identifying one or 
more sets of duplicate network packets that were captured by the plurality of agents at the 
different locations, as required by Applicant's amended independent claim 32. 

Instead, Kant discloses capturing network packets and calculating network performance 
for a network with source-destination pairings. In the Kant reference, the source device is 
coupled to the destination device via an overhead channel used to pass the packages created by 
the source device* The destination device in Kant analyzes the packet flow only between the 
source-destination pair based on the packets captured by the source device and the destination 
device. Kant does not describe the destination device analyzing packet flows based on packets 
captured from a plurality of distributed devices positioned at different locations within the 
network. Furthermore, Kant teaches away from Applicant's claimed invention by specifically 
not using a centrally located analyzer to analyze packet flows wjthjn a network. Kant also fails 
to describe an analyzer that identifies duplicate packets received from a plurality of distributed 
agents at different locations within the network 

For the reasons described above in reference to claims 2 and 3, McCreery does not 
disclose displaying non-duplicate network packets and displaying a selected representative 
packet for each set of duplicate packets, as recited by Applicant's amended independent claim 
32. Nor does McCreery disclose comparing timestamps of the duplicate packets, and displaying 
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one of the packets based on the comparison, as recited by Applicant's claim 33, which depends 
from claim 32. Instead, McCreery teaches sequencing the packets via an analysis of the 
administrative data included in the packet headers such as the sequencing and acknowledgment 
information provided in the TCP segment, which does not include the timestamp. McCreery 
then describes discarding any duplicate packets found after sequencing the packets based on the 
information in the TCP segment 

Furthermore, contrary to the Examiner's assertion, deleting entries for duplicate packets 
does not render obvious displaying a selected representative packet for the duplicate packets. In 
accordance with Applicant's specification, the representative packet represents the entire set of 
duplicate packets such that only one of the duplicate packets is displayed while the remainder of 
the duplicate packets not selected as die representative packets are stored. In this way, the 
remainder of the duplicate packets may be utilized or displayed at a later time. Moreover, 
Applicant's amended claim 32 recites displaying a selected representative packet for the 
duplicate packets* Merely deleting duplicate packets upon identifying the packets as duplicates 
does not include selecting one of the identified duplicate packets as a representative packet. 
Clearly, displaying a representative packet for the duplicate packets is not the same as deleting 
entries of duplicate packets, and would not be obvious to a person of ordinary skill in the art. 

In a similar manner, Kant and McCreery provide no teaching that would have suggested 
the additional requirements of Applicant's dependent claims 34, 35, 37 and 38, some of which 
are discussed below for purposes of illustration. Moreover, the references lack any teaching that 
would have suggested the desire to modify the references to arrive at the features set forth in the 
dependent claims. 

With respect to claims 35, 37 and 38, the Examiner stated that Kant discloses displaying 
the captured network packets into sets of network packets based on source and destination 
number. In support of the rejection, the Examiner merely refers to FIG. 10 of Kant, which 
illustrates a data structure for a package of packets sent to a destination device from a source 
device, Claim 35 recites aggregating the captured network packets into sets of network packets 
based on source information and destination information for the network packets. Applicant 
respectfully submits that the Examiner's argument does not apply to claim 35. Moreover, Kant 
makes no mention of aggregating captured network packet into sets. 
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Claim 37 recites graphically illustrating the set of aggregated network packets. As 
described above, Kant fails to disclose displaying or presenting network packets to a user. FIG. 
10 of Kant merely illustrates a data structure of a package sent from a source device to a 
destination device that lists network packets. Kant never describes presenting the illustrated 
package data structure, or any other packet information, to a user. Kant certainly does not 
disclose graphically illustrating a set of network packets. 

For at least these reasons, the Examiner has failed to establish a prima facie case for non- 
patentability of Applicant's claims 2, 3, 32-35, 37 and 38 under 35 U.S.C. 103(a). Withdrawal of 
this rejection is requested. 

Fletcher and McCreery 

Applicant has amended independent claim 5 to include all the subject matter recited by 
dependent claim 6, which the Examiner indicated would be allowable if rewritten in independent 
form. In addition, Applicant has amended independent claim 14 to include all the subject matter 
recited by dependent claim 16 and intervening claim 15, which the Examiner indicated would be 
* *■*-»• ^allowable if rewritten in independent form. Therefore, claims 5 and 14 are in condition for 

allowance as are claims 9, 10, 15 and 21 dependent therefrom. Applicant has canceled claims 6, 
14 and 15. 

With respect to independent claim 22, the Examiner stated that Fletcher discloses 
distributed remote monitoring (dRMON) agents capturing network packets, a management 
station with a display receiving captured data from dRMON agents where the management 
station sorts and aggregates captured data into a database. The Examiner acknowledged that 
Fletcher fails to disclose identifying duplicate packets captured by different agents. However, the 
Examiner asserted that McCreery discloses discarding duplicated packets, and that it would have 
been obvious to one of ordinary skill in the art to modify Fletcher to adopt the decoded packet 
recompiler of McCreery to analyze network traffic between a given source and destination node 
without taking into account duplicate packets. 

Applicant has amended independent claim 22 to include all the subject matter of 
dependent claim 23, now cancelled Claim 22 now recites wherein the aggregation module 
presents non-duplicate network packets and a representative packet for the duplicate packets on 
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the display. In support of the rejection of now canceled claim 23, the Examiner acknowledged 
that Fletcher fails to disclose displaying a representative packet for the duplicate packets, but 
stated that it would have been obvious to one of ordinary skill in the art to delete entries for 
duplicate packets to display one entry for the duplicate packets so that network performance 
parameters such as packet throughput would be measured without taking into account 
retransmitted packets. 

As described above, deleting entries for duplicate packets is not equivalent to displaying a 
selected rep resentative packet for the duplicate packets. In accordance with Applicant's 
Specification, the representative packet represents the entire set of duplicate packets such that 
only one of the duplicate packets is displayed while the remainder of the duplicate packets not 
selected as the representative packets are stored. In this way, the remainder of the duplicate 
packets may be utilized or displayed at a later time. Moreover, Applicant's amended claim 22 
recites displaying a selected representative packet for the duplicate packets. Merely deleting 
duplicate packets upon identifying the packets as duplicates does not include selecting one of the 
identified duplicate packets as a representative packet. Clearly, displaying a representative 
packet for the duplicate packets is not the same as deleting entries of duplicate packets, and 
would not be obvious to a person of ordinary skill in the art. 

In a similar manner* Fletcher and McCreery provide no teaching that would have 
suggested the additional requirements of Applicant's dependent claims 24, 26, 27 and 31, some 
of which are discussed below for purposes of illustration. Moreover, the references lack any 
teaching that would have suggested the desire to modify the references to arrive at the features 
set forth in the dependent claims. 

Claim 24 recites wherein the agents assign the captured packets timestamps, and further 
wherein the aggregation module compares the timestamps of the duplicate packets and selects 
one of the duplicate packets for display as the representative packet. In the Office Action, the 
Examiner stated that McCreery discloses displaying captured packets with timestamps and that it 
would have been obvious to one of ordinary skill in the art to delete entries for duplicate packets 
to display one entry for the duplicate packets. 

As described above, McCreery describes a method of recompiling packet data within the 
illustrated data tables by segregating the packet data into transactions between nodes, sorting the 
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packet data by the nodes, sequencing the packet data in each transaction, and deleing any 
duplicate packets from the sequence. However, unlike Applicant's claim 24, McCreery does not 
disclose comparing timestamps of duplicate packets and displaying one of the packets based on 
the comparison* Instead, McCreery teaches sequencing the packets via an analysis of the 
administrative data included in the packet headers such as the sequencing and acknowledgment 
information provided in the TCP segment, which does ngt include the timestamp. McCreery 
then describes discarding any duplicate packets found after sequencing the packets based on the 
information in the TCP segment. 

In addition, deleting entries for duplicate packets is not equivalent to displaying a 
representative packet for the duplicate packets. Applicant's claim 24 recites selecting a 
representative packet for the duplicate packets in order to display one of the duplicate packets 
while not discarding the remainder of the duplicate packets not selected as the representative 
packets. Displaying a selected representative packet for the duplicate packets is not the same as 
deleting entries of duplicate packets, and would not be obvious to a person of ordinary skill in the 
art 

Fletcher and McCreery also fail to teach or suggest thele^fes of Applicant's claims 1-4 
and 32-35, 37 and 38, For example, Fletcher and McCreery, either singularly or in combination, 
fail to disclose identifying duplicate network packets that were captured by the plurality of agents 
at the different locations and displaying one of the duplicate network packets and non-duplicate 
network packets based on the identification, as recited by Applicant's independent claim 1 . In 
addition, Fletcher and McCreery, either singularly or in combination, fail to disclose identifying 
one or more sets of duplicate network packets that were captured by the plurality of agents at the 
different locations, displaying non-duplicate network packets, and displaying a representative 
packet for each set of duplicate packets, as recited by Applicant's independent claim 32. 

For at least these reasons, the Examiner has failed to establish a prima facie case for non- 
patentability of Applicant's claims 2, 3, 5, 9, 10, 14, 15, 21-24, 26, 27, 31-35, 37 and 38 under 35 
U.S.C. 103(a). Withdrawal of this rejection is requested. 
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CONCLUSION 

All claims in this application are in condition for allowance, Applicant respectfully 
requests reconsideration and prompt allowance of all pending claims. Please charge any 
additional fees or credit any overpayment to deposit account number 50-1778. The Examiner is 
invited to telephone the below-signed agent to discuss this application. 

Date: 

August 17. 2006 

SHUMAKER & SIEFFERT, P.A 
8425 Seasons Parkway, Suite 105 
St. Paul, Minnesota 55125 
Telephone: 651.735.1100 
Facsimile: 651.735.1102 



By: 




Name:/Darcy L. Grunwald 
Reg. No.: 56,902 
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